hreffy[.]dev

This domain hreffy.dev is currently active and resolves to 185.114.245.108, an IP owned by JSC “TIMEWEB” in Russia. The authoritative nameservers ns1.timeweb.ru and ns2.timeweb.ru confirm hosting with the same provider. The site presents an HTTPS endpoint with a GlobalSign NV‑SA certificate chained to GlobalSign GCC R3 DV TLS CA 2020 and enforces HSTS, but returns an HTTP 301 redirect, indicating a possible landing page change. The page title, “Hreffy — бесплатный SEO‑аудит сайта за 30 секунд | Анализ 50+ параметров”, suggests the site is positioned as a free SEO audit service, a common lure for credential‑phishing. The domain was registered on 28 April 2026 through Fewmoretaps OU d/b/a Trustname.com and has a Gridinsoft trust score of 0/100. Threat intelligence sources list the domain in one blocklist and note it in a single AlienVault OTX pulse. VirusTotal scans report three detections out of 91 vendors, reinforcing the high‑risk classification. Uncertainty remains regarding the exact phishing kit or the specific victim profile, as no malware samples or credential‑harvesting URLs have been publicly disclosed. Defenders should block DNS resolution for hreffy.dev, enforce network‑level deny‑list rules, and monitor outbound connections to 185.114.245.108. Additional sandbox analysis of any downloaded payloads from the URL, as well as correlation with user‑reported phishing attempts, is recommended to confirm the attack vector and to update detection signatures.